Files can open slowly with GTI enabled and the ENS Common policy set to "Use system proxy settings"

Technical Articles ID: KB95012
Last Modified: 2021-12-22 19:41:11 Etc/GMT

Environment

Endpoint Security (ENS) 10.7.0 September 2021 Update and later

Problem

When a system has been configured to use the Proxy Server, Use system proxy settings option, either through ePolicy Orchestrator (ePO) policy management or standalone configuration, connections to amcore.rest.gti.mcafee.com might fail. When the connection is attempted directly, and if direct connection is blocked or disallowed, the lookup creates short delays in file access. Behavior such as seeing Outlook hang briefly when opening PDF files has also been observed.

When validating GTI-REST communication using the following article, detection might be observed: KB53733 - Verify that GTI File Reputation is installed and endpoints can communicate with the GTI server. But, if the detection name isn’t Artemis!<string>, GTI-REST file reputation wasn’t communicated properly.

System Change

Installed ENS 10.7.0 September 2021 Update, which enabled REST-GTI connectivity by default.

Cause

The Scan Engine tries to access amcore.rest.gti.mcafee.com without using the configured setting to auto-detect system proxy details.

Solution

A change has been implemented in AMCore 4654 and later. The change allows the Scan Engine to query WPAD for proxy information when Use system proxy settings is selected.

Workaround 1

Configure your network to allow direct connections to https://amcore.rest.gti.mcafee.com. For more information, see: KB93324 - Endpoint Security off-box communication URLs.

It’s considered best practice to exclude Global Threat Intelligence (GTI) servers from your proxy, and allow direct connection instead, for optimal scan performance.

Workaround 2

Instead of automatically detecting settings, manually configure the proxy settings in the ENS Common policy.

ePO:

In the ePO console, go to Policy Catalog, Endpoint Security Common, Options.
In any policies configured to Use system proxy settings, modify them to use the Configure proxy server setting.
Manually enter the HTTP address (DNS, IPv4, or IPv6), port, and any excluded addresses into the policy. You can also configure HTTP Proxy authentication here.
Save the policy, and assign it to systems accordingly.

Standalone:

Open the ENS console
Open the Settings pane. (Opening this pane might require Administrator authentication, configured through the ENS Common Options policy.)
Scroll down to Proxy Settings.
Select the Configure proxy server setting option, and manually enter the HTTP address (DNS, IPv4, or IPv6), port, and any excluded addresses into the policy. You can also configure HTTP Proxy authentication here.
Save the settings.

For more information regarding proxy configuration in ENS, see the Endpoint Security 10.7.x Product Guide.

Knowledge Center

Files can open slowly with GTI enabled and the ENS Common policy set to "Use system proxy settings"

Environment

Problem

System Change

Cause

Solution

Workaround 1

Workaround 2

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Files can open slowly with GTI enabled and the ENS Common policy set to "Use system proxy settings"

Environment

Problem

System Change

Cause

Solution

Workaround 1

Workaround 2

Related Information

Affected Products

Languages:

Choose your region

Title

Title